I attached the above policy to a test bucket and used only the deny statement and it works fine:
{
“Version”: “2008-10-17”,
“Id”: “S3BubbleCloudfrontSecurity”,
“Statement”: [
{
“Sid”: “S3BubbleDenyDelete”,
“Effect”: “Deny”,
“Principal”: “*”,
“Action”: [
“s3:DeleteObject”,
“s3:DeleteObjectVersion”
],
“Resource”: “arn:aws:s3:::<bucket-name>/*”
}
]
}
But this is a little bit inconvenient for me as the HLS encoding and encryption has to be done in the same bucket, which leaves the original video file in the bucket. I would like to delete the original files as they are huge and I have to pay for storage. Also what if the bucket itself gets deleted by mistake or if somebody gains access to the account with malicious intends? I know these are very rare probabilities, but back to the general question, is there a way to backup the whole bucket somehow and having a script checking for new files and backing them up on regular basis?
